Apple blocks bafflingly weak security certificates on iPhone

Apple has blocked a set of eight compromised security certificates on iOS and iPadOS, following a discovery of their weak encryption. These certificates, issued by the Indian certificate authority eMudhra, were pulled after researchers found them to be extremely weak. The certificates, which were used to secure internet traffic and verify domain ownership, were later revoked by eMudhra on October 17.

Google and Mozilla had already blocked six of the compromised certificates in their respective browsers on October 17. Apple followed suit on October 19, adding protections to its iOS and iPadOS systems. The weak keys associated with these certificates were particularly easy to guess, resembling simple passwords like "password" or "123".

Mozilla was able to recover the private keys easily, highlighting the significant security vulnerability. While most of the certificates hadn't been deployed and there is no evidence of attackers exploiting them, Apple users are advised to update their software as soon as possible. On Macs, users should also be cautious, as the built-in curl utility doesn't check revocation information, potentially allowing the compromised certificates to continue being trusted.

The certificate authority eMudhra stated that no infrastructure compromise or data breaches occurred, and they are assisting customers with affected certificates.